#CVE

共收录 56389 条相关情报。

漏洞预警2026-10-31 发布MEDIUM

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all ...

CVE-2026-116563

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:medium

漏洞预警2026-10-31 发布HIGH

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as th...

CVE-2026-116520

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布INFO

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, al...

CVE-2026-110808

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assig

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布INFO

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contribu...

CVE-2026-110042

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays i

来源摘录 · NVD / GitHub Advisory

#advisory #cve

漏洞预警2026-10-31 发布HIGH

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formDat...

CVE-2026-109997

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布HIGH

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5...

CVE-2026-109234

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-79 #severity:high

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-94 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all ver...

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-94 #severity:medium

漏洞预警2026-10-31 发布HIGH

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access...

CVE-2026-116755

Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of Sof

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-78 #severity:high

漏洞预警2026-10-31 发布HIGH

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a f

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-863 #severity:high

漏洞预警2026-10-31 发布MEDIUM

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (h...

CVE-2026-77152

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collecti

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-285 #severity:medium

漏洞预警2026-10-31 发布INFO

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impers...

CVE-2026-117656

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth A

来源摘录 · NVD

#cve #cwe-290 #cwe-349

漏洞预警2026-10-30 发布INFO

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context...

CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticate

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-30 发布MEDIUM

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_c...

CVE-2026-63410

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar

来源摘录 · NVD

#cve #cwe-1255 #cwe-208

漏洞预警2026-10-30 发布MEDIUM

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses ...

CVE-2026-63402

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` che

来源摘录 · NVD

#cve #cwe-1321 #cwe-471

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `...

CVE-2026-63401

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAc

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An ...

CVE-2026-63400

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the passwo

来源摘录 · NVD

#cve #cwe-613

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary or...

CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operati

来源摘录 · NVD

#cve #cwe-306 #cwe-799

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUse...

CVE-2026-63398

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolv

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-30 发布INFO

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessib...

CVE-2026-63396

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.

来源摘录 · NVD

#cve #cwe-306